Control circuit for a passenger protection device in a motor vehicle and corresponding method of operation

ABSTRACT

The invention relates to a control circuit for at least one passenger protection system ( 6-8 ) in a motor vehicle, comprising a plurality of sensors for detecting a respective parameter of the motor vehicle, and an evaluation unit connected to the sensors at the input side and adapted to produce, in accordance with the measured parameters, a release signal (Enable 1 ) activating the passenger protection device in the case of an accident. The control circuit further comprises a check unit ( 10 ) connected to the sensors at the input side and adapted to check the mutual plausibility of the parameters measured by the sensors and to output a first disable signal (Error) for the passenger protection device in the case of an incorrect plausibility check. A logical circuit ( 11-14, 21-28 ) is connected to the evaluation unit ( 4, 5 ) and the check unit on the input side and to the passenger protection device on the output side and blocks activation of the passenger protection device when a first disable signal (Error) is received. At least one inducer element ( 15-17 ) is provided for simulating a malfunction of the sensors and/or of the check unit. Said inducer element simulates only a single sensor or only a part of the sensors, thereby simulating a malfunction of the remaining sensors.

CLAIM FOR PRIORITY

This application is a national stage application under 371, claiming thebenefit of PCT/DE00/02854, which was filed on Aug. 22, 2000.

TECHNICAL FIELD OF THE INVENTION

The invention relates to a control circuit for at least onevehicle-occupant protection system in a motor vehicle and to anassociated operating method.

BACKGROUND OF THE INVENTION

In modern motor vehicles, vehicle-occupant protection systems such asairbags, side bags or seatbelt pretensioners are used to reduce theseverity of the injuries to vehicle occupants which occur in the case ofaccidents. The triggering of the vehicle-occupant protection systems iscarried out here by means of a plurality of acceleration sensors whichare arranged in the motor vehicle and which measure the accelerationwhich respectively occurs in a predefined direction in the case of anaccident. As the individual acceleration sensors have different spatialorientations, both the direction and the magnitude of the accelerationcan be calculated from the output signals of the acceleration sensors,the vehicle-occupant protection systems being activated if the magnitudeof the acceleration exceeds a predefined limiting value (for example 10g).

German laid-open application DE 196 45 952 A1 discloses a controlcircuit which evaluates the measurement signals of a plurality ofacceleration sensors in order to detect an accident of the motor vehicleand activates the vehicle-occupant protection systems as a function ofthe measurement signals. Furthermore, this publication discloses thatthe measurement signals of the various acceleration sensors are to besubjected to a plausibility test in order to detect a malfunction ofindividual sensors or of the control circuit. If the variousacceleration sensors are arranged, for example, in a star shape in oneplane, the sum of the positive or negative accelerations which aremeasured by the acceleration sensors must be equal to zero. If thecomposite signal of the acceleration sensors deviates from this value, amalfunction is present in one or more of the sensors or else in thecontrol unit itself. The plausibility check, described above, of themeasurement signals generated by the acceleration sensors thereforeadvantageously makes it possible to detect a malfunction of the sensorsor of the evaluation unit which analyses the measurement signals of theacceleration sensors in order to detect an accident.

However, a disadvantage of the known control circuit described above isthat when the measurement signals which are supplied by the accelerationsensors are subject to a plausibility check during normal operation thecheck may be subject to errors.

On the one hand, this can lead to undesired triggering of avehicle-occupant protection system if an acceleration sensor outputs ahigh acceleration value owing to a malfunction and the plausibilitycheck does not detect the malfunction of the sensor.

On the other hand, an error in the plausibility check can lead to asituation in which the triggering of the vehicle-occupant protectionsystem is disabled when there is an accident although the accelerationsensors measure a high acceleration value.

SUMMARY OF THE INVENTION

The invention discloses a vehicle-occupant protection system in a motorvehicle to the effect that the operational capability of theplausibility check can be tested. Furthermore, the invention is based onan operating method for a control circuit which is improved in this way.

In one embodiment of the invention, the invention comprises carryingout, before or during the normal operation of the control circuit, aself-test in which a single sensor or some of the sensors are excited inorder, for example, to simulate an acceleration in an accelerationsensor, whereas the other sensors are not excited, or are excited insome other way, so that the plausibility check normally yields anerrored result.

In one aspect of the invention, in order to evaluate the measurementsignals supplied by the sensors during normal operation, the controlcircuit according to the invention preferably has an evaluation unitwhich is connected at the input end to the sensors and which detects anaccident on the basis of the measured parameters and then generates atriggering signal which activates the vehicle-occupant protectionsystem. The parameters measured by the sensors are therefore analyzed bythe evaluation unit during normal operation in order to detect anaccident.

Furthermore, the control circuit according to another aspect of theinvention has a check unit in order to subject the parameters measuredby the sensors to a plausibility check. For this purpose, the check unitis connected at the input end to the sensors and, when a plausibilitycheck fails, generates a disable signal at the output end in order toprevent activation of the vehicle-occupant protection system.

In addition, the control circuit according to one embodiment of theinvention has a logic circuit which is connected at the input end bothto the evaluation unit and to the check unit, and at the output endactuates the vehicle-occupant protection system, the vehicle-occupantprotection system being actuated as a function of the triggering signalgenerated by the evaluation unit and the disable signal which isgenerated by the check unit.

The self-test of the control circuit can preferably be initiated by theuser. For this purpose, the excitation element which is used to excite asensor is preferably connected to a controllable switching element whichcan be activated by the user in order to initiate the self-test.

The logic circuit for actuating the vehicle-occupant protection systemas a function of the disable signal and the triggering signal ispreferably also connected at the input end to the controllable switchingelement in order to receive a second disable signal, the logic circuitdisabling or enabling the activation of the vehicle-occupant protectionsystem as a function of the two disable signals.

In this way, the logic circuit can disable the activation of thevehicle-occupant protection system, for example, if the first disablesignal generated by the check unit is present and the plausibility checkis thus errored, while at the same time the second disable signal whichis generated by the controllable switching element is not present as thecontrol circuit is in the normal operating mode and not in the self-testoperating mode.

Furthermore, the logic circuit can disable the activation of thevehicle-occupant protection system if the second disable signal ispresent during the self-test operating mode but the first disable signalis not present, and the plausibility check has thus run successfullydespite the simulated malfunction, which makes it possible to concludethat the plausibility check was errored.

In the preferred embodiment of the control circuit according to theinvention, the logic circuit has a sample-and-hold element in order tomaintain the first disable signal generated by an errored plausibilitycheck even when there is a successful plausibility check in themeantime.

The triggering of the vehicle-occupant protection system is thereforedisabled here after an errored plausibility check until thesample-and-hold element is reset. For this purpose, the sample-and-holdelement can be connected, for example, to a switching element which canbe operated manually.

BRIEF DESCRIPTION OF THE DRAWINGS

Further advantageous developments of the invention are explained belowtogether with the description of the preferred exemplary embodimentsaccording to the invention with reference to the figures, in which:

FIG. 1 shows a control circuit according to an embodiment of theinvention as a block circuit diagram.

FIG. 2 shows an arrangement of the acceleration sensors in a motorvehicle.

FIG. 3 shows an optional supplementary module for the control circuitillustrated in FIG. 1.

FIG. 4 shows an operating method according to an embodiment of theinvention as a flowchart.

DETAILED DESCRIPTION OF THE INVENTION

The control circuit illustrated in FIG. 1 has a plurality ofacceleration sensors 1, 2, 3 which are arranged in a horizontal plane ina motor vehicle 4, at different angles with respect to the longitudinalaxis x of the motor vehicle 4, as is apparent from FIG. 2.

The acceleration sensors 1, 2, 3 are connected at the output ends to anarithmetic unit 4 which calculates the acceleration values a_(x) anda_(y) in the longitudinal direction X of the vehicle and in thetransverse direction Y of the vehicle from the measurement signalsa_(u), a_(v), a_(w) of the acceleration sensors 1, 2, 3, according tothe following formulas:a _(x) =a _(u) +a _(v)·cos<(X,V)+a _(w)·cos<(X,W)a _(y) =a _(v)·cos<(Y,V)+a _(w)·cos<(Y,W).

At the output end, the arithmetic unit 4 is connected to an evaluationunit 5 which compares the acceleration values a_(x) and a_(y) in thelongitudinal or transverse direction of the vehicle with predefinedmaximum values, and when the maximum values are exceeded generatesactuation signals Enable1-Enable4, which are to used to activatevehicle-occupant protection systems 6, 7, 8, 9, the vehicle-occupantprotection systems 6, 7 being airbags, whereas the vehicle-occupantprotection systems 8, 9 are side bags.

Furthermore, the circuit arrangement illustrated has a check unit 10which is connected at the input end to the acceleration sensors 1, 2, 3,and carries out a plausibility check of the measured acceleration valuesa_(u), a_(v) and a_(w) in order to detect a malfunction of one of theacceleration sensors 1, 2, 3. In this way, the check unit 10 calculatesthe sum of the acceleration measured values a_(u), a_(v) and a_(w) whichhas to be equal to zero when the function is satisfactory. The checkunit 10 then compares the sum signal formed in this way with apredefined maximum value and outputs a disable signal Error in the sumsignal exceeds the predefined maximum value.

At the output end, the check unit 10 is connected to thevehicle-occupant protection systems 6, 7, 8, 9 via a logic circuit, thelogic circuit having four AND elements 11, 12, 13, 14 which areconnected at the input end to the evaluation unit 5 and to the checkunit 10, and at the output end are each connected to one of thevehicle-occupant protection systems 6, 7, 8, 9. In this way, thevehicle-occupant protection system 6 is activated, for example, by anactivation signal Fire1 if the triggering signal Enable1 is present atthe AND element 11 at the input end and the disable signal Disable thusassumes a low level. The triggering of the vehicle-occupant protectionsystems 6, 7, 8, 9 is therefore disabled by the check unit 10 if theplausibility check carried out by the check unit 10 has provided anerrored result.

Furthermore, the control circuit illustrated permits a self-test inwhich the plausibility check carried out by the check unit 10 is tested.For this purpose, the control circuit has three excitation elements 15,16, 17 which are each assigned to one of the acceleration sensors 1, 2,3 and permit a separate excitation of the acceleration sensors 1, 2, 3in order to simulate a malfunction of the rest of the accelerationsensors. In order to actuate the excitation elements 15, 16, 17, threecontrollable switching elements 18, 19, 20 are provided which can beactivated separately by the user. When the switching element 18 isactivated, for example the excitation element 17 is activated, afterwhich the acceleration sensor 3 measures an acceleration, whereas theacceleration sensors 1, 2 are not excited and therefore do not measureany acceleration. When only the acceleration sensor 3 is excited, thecheck unit 10 therefore generates an error signal Error which is fed tothe logic circuit already mentioned above, which will now be describedin more detail.

The logic circuit thus has an OR element 21 which is connected at theinput end to the three switching elements 18, 19, 20 and generates adisable signal Test with a high level when at least one of the switchingelements 18, 19, 20 is activated. The disable signal Test is fed to theAND elements 11, 12, 13, 14 via an inverter 22 in order to prevent thevehicle-occupant protection systems 6, 7, 8, 9 from being activatedduring the self-test.

In what follows, the self-test of the control circuit will be describedfor the case in which the acceleration sensors 1, 2, 3 and the checkunit are operating satisfactorily. In this case, a high level appearsboth at the output of the OR element 21 and at the output of the checkunit 10, the disable signal Error which is generated by the check unit10 and the disable signal Test which is generated by the in the ANDelement 21 being fed to two AND elements 25, 26 via two inverters 23,24. The two AND elements 25, 26 are connected via an OR element 27 to asample-and-hold element 28 which holds the disable signal Disablepresent at the input end until the user activates a resetting inputReset of the sample-and-hold element 28 by means of a switching element29. The sample-and-hold element 28 therefore prevents thevehicle-occupant protection systems 6, 7, 8, 9 from being activatedafter a failed plausibility check even after a successful plausibilitycheck in the meantime until the sample-and-hold element 28 is reset bymeans of the switching element 29.

When the accelerated sensors 1, 2, 3 and the check unit 10 are operatingsatisfactorily during the self-test, a high level appears at the outputof the check unit 10 and at the output of the OR element 21,respectively, so that the signal Disable assumes a low level at theinput of the sample-and-hold element 28. This is appropriate as thedisable signal Error appearing at the output of the check unit 10 shows,during the self-test, that the acceleration sensors 1, 2, 3 and thecheck unit 10 are operating satisfactorily.

On the other hand, when there is a malfunction of the accelerationsensors 1, 2, 3 or of the check 10 during the self-test, a low levelappears at the output of the check unit 10 so that the two inputs of theAND element 26 assume a high level which is passed on via the OR element27 to the sample-and-hold element 28, which leads to permanent disablingof an activation of the vehicle-occupant protection systems 6, 7, 8, 9.

In what follows, the normal operating mode of the control circuit willnow be operated, the switching elements 18, 19, 20 being opened so thata low level appears at the output of the OR element 27. When theacceleration sensors 1, 2, 3 and the check unit 10 are functioningsatisfactorily, a low level also appears at the output of the check unit10 in the normal operating mode as the plausibility check then proceedssuccessfully. In this case, no disable signal with a high level appearsat the input of the sample-and-hold element 28 either so that theenabling of the vehicle-occupant protection systems 6, 7, 8, 9 is notdisabled.

On the other hand, if there is a malfunction of the sensors 1, 2, 3, theplausibility check by the check unit 10 leads to a high level at theoutput of the check unit 10 so that a high level appears at the outputof the AND element 25, which high level is fed via the OR element 27 asa disable signal to the sample-and-hold element 28, after which theactivation of the vehicle-occupant protection systems 6, 7, 8, 9 isdisabled until the sample-and-hold element is reset again by means ofthe switching element.

FIG. 3 shows an optional module 30 for the control circuit which isdescribed above and illustrated in FIG. 1, the module 30 being connectedat the input end to the three acceleration sensors 1, 2, 3 and at theoutput end to the individual AND elements 11, 12, 13, 14 which actuatethe vehicle-occupant protection systems 6, 7, 8, 9. For the sake ofsimplification, the AND element 11 is illustrated in FIG. 3, but themodule 30 is connected at the output end to all the AND elements 11-14which thus each have three controlled inputs. The module 30 has aplurality of evaluation units 31, 32, 33 which compare the accelerationvalues a_(u), a_(v), a_(w) measured by the acceleration sensors 1, 2, 3with predefined minimum values and output a low level at the output endwhen the value drops below the minimum values, the evaluation units 31,32, 33 being connected at the output end to an OR element 34 whichactuates the AND elements 11-14. Activation of the vehicle-occupantprotection systems 6, 7, 8, 9 is therefore prevented independently ofthe result of the plausibility check even if the acceleration valuesmeasured by the acceleration sensors 1, 2, 3 are all below the minimumvalues because the motor vehicle is stationary, for example.

The invention is not restricted to the exemplary embodiment describedabove. Instead, a multiplicity of variants and modifications which makeuse of the inventive idea and therefore also fall within the scope ofprotection are conceivable.

1. A control circuit for at least one vehicle-occupant protection systemin a motor vehicle, comprising: a plurality of sensors to detect arespective parameter of the motor vehicle; an evaluation unit which isconnected to the sensors at the input end to generate a triggeringsignal which activates the vehicle-occupant protection system based onthe measured parameters when there is an accident; a check unit, whichis connected to the sensors at the input end, to check a mutualplausibility of the parameters which are measured by the sensors and tooutput a first disable signal for the vehicle-occupant protection systemwhen there is an errored plausibility check; and a logic circuit, whichis connected at the input end to the evaluation unit and to the checkunit and at the output end to the vehicle-occupant protection system fordisabling activation of the vehicle-occupant protection system when thefirst disable signal is present, wherein to simulate a malfunction ofthe sensors and/or of the check unit, at least one excitation elementprovided which excites a single sensor or some of the sensors andsimulates a malfunction of the rest of the sensors.
 2. The controlcircuit as claimed in claim 1, wherein the excitation element isconnected to a first controllable switching element to performcontrollable activation.
 3. The control circuit as claimed in claim 2,wherein to receive a second disable signal for the vehicle-occupantprotection system, the logic circuit is connected to the firstcontrollable switching element during the simulation of a sensormalfunction, the logic circuit disabling or enabling the activation ofthe vehicle-occupant protection system as a function of the two disablesignals.
 4. The control circuit as claimed in claim 3, wherein the logiccircuit disables the activation of the vehicle-occupant protectionsystem if the first disable signal is present and/or the second disablesignal is not present.
 5. The control circuit as claimed in claim 3,wherein the logic circuit disables the activation of thevehicle-occupant protection system if the first disable signal is notpresent although the second disable signal is present.
 6. The controlcircuit as claimed in claim 1, wherein the logic circuit has asample-and-hold element to maintain the first disable signal, generatedafter an errored plausibility check, even if there was a successfulplausibility check in the meantime.
 7. The control circuit as claimed inclaim 6, wherein the logic circuit actuates the sample-and-hold elementto permanently disable the vehicle-occupant protection system if, duringthe simulation of a sensor malfunction, the second disable signal ispresent whereas the second disable signal is not present.
 8. The controlcircuit as claimed in claim 6, wherein the sample-and-hold element has aresetting input to delete the stored disable signal.
 9. The controlcircuit as claimed in claim 8, wherein the resetting input is connectedto a switching element to be able to delete the disable signal manually.10. The control circuit as claimed in claim 1, further comprisinganother check unit which is connected to the sensors at the input end isprovided, the another check unit comparing the parameters measured bythe sensors in each case with a predefined minimum value and generatinga third disable signal if the measured parameters drop below thepredefined minimum values.
 11. The control circuit as claimed in claim1, wherein at least one sensor is an acceleration sensor or an angle ofinclination sensor.
 12. The control circuit as claimed in claim 1,wherein the vehicle-occupant protection system is an airbag, a side bag,a seatbelt pretensioner or a seatbelt force limiter.
 13. An operatingmethod for a control circuit, comprising: measuring at least oneparameter of the motor vehicle by a plurality of sensors; evaluating theparameters which are measured by the sensors to detect an accident;performing a mutual plausibility check of the parameters measured by thesensors during normal operation; and activating at least onevehicle-occupant protection system when there is an accident and asuccessful plausibility check, wherein at least one sensor is excited ina self-test to simulate a malfunction of the rest of the other sensors,the activation of the vehicle-occupant protection system being disabledif the plausibility check proceeds without errors despite the simulatedmalfunction of the sensors.
 14. The operating method as claimed in claim13, wherein the activation of the vehicle-occupant protection system ispermanently disabled if the plausibility check is errored in the normaloperating mode and/or has proceeded without errors in the self-test. 15.The operating method as claimed in claim 13, wherein the parameterswhich are measured by the sensors are compared with predefined minimumvalues, the activation of the vehicle-occupant protection system beingdisabled if the parameters measured by the sensors are below the minimumvalue.